2503 matches found
CVE-2007-5110
CVE-2007-5110 describes an absolute path traversal in the EB Design ebCrypt ActiveX control (EbCrypt.eb_c_PRNGenerator.1) within EBCRYPT.DLL 2.0.0.2087 and earlier. The vulnerability allows remote attackers to create or overwrite arbitrary files by passing a full pathname to the SaveToFile method...
Design/Logic Flaw
The main function in skkdic-expr.c in SKK Tools 1.2 allows local users to overwrite or delete arbitrary files via a symlink attack on a skkdic$PID temporary file...
Directory traversal
Directory traversal vulnerability in WinImage 8.10 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a .. dot dot in a filename within a 1 .IMG or 2 .ISO file. NOTE: this can be leveraged for code execution by writing to a Startup folder...
Directory traversal
Directory traversal vulnerability in X-Diesel Unreal Commander 0.92 build 565 and 573 allows remote FTP servers to create or overwrite arbitrary files via a .. dot dot in a filename. NOTE: this can be leveraged for code execution by writing to a Startup folder...
Timbuktu Pro < 8.6.5 Multiple Vulnerabilities
According to its version, the installation of Timbuktu Pro on the remote host reportedly is affected by three buffer overflows that can be exploited without authentication to crash the service or execute arbitrary code on the affected host with SYSTEM privileges. In addition, the application also...
Directory traversal
Directory traversal vulnerability in Motorola Timbuktu Pro before 8.6.5 for Windows allows remote attackers to create or delete arbitrary files via a .. dot dot in a Send request, probably related to the 1 Send and 2 Exchange services...
Unreal Commander畸形压缩文档多个远程漏洞
BUGTRAQ ID: 25419 Unreal Commander是一款免费的Windows平台文件管理器。 Unreal Commander在解压文件时存在多个安全漏洞，攻击者可能通过诱使用户处理恶意文件控制用户系统。 如果用户使用Unreal Commander解压了文件名包含有类似于以下目录遍历序列的ZIP或RAR文档的话： Something/../../../../../../Program Files/Something/ws232.dll 就会导致在指定目录中创建ws232.dll文件。 ZIP文档中包含有两处写入文件名的位置：Local文件头和Central...
Nessus Windows < 3.0.6.1 ScanCtrl ActiveX Multiple Method File Manipulation
The remote host contains the ScanCtrl ActiveX control, a part of Nessus for Windows. The version of the ScanCtrl ActiveX control, installed as part of Nessus for Windows on the remote host, fails to validate input to several methods. If an attacker can trick a user on the affected host into...
CVE-2007-3883
The Data Dynamics ActiveBar ActiveX control actbar3.ocx 3.2 and earlier allows remote attackers to create or overwrite files via a full pathname in 1 the second argument to the Save method, or the first argument to the 2 SaveLayoutChanges or 3 SaveMenuUsageData method...
CVE-2007-3883
The Data Dynamics ActiveBar ActiveX control actbar3.ocx 3.2 and earlier allows remote attackers to create or overwrite files via a full pathname in 1 the second argument to the Save method, or the first argument to the 2 SaveLayoutChanges or 3 SaveMenuUsageData method...
Data Dynamics ActiveBar ActiveX (actbar3.ocx <= 3.1) Insecure Methods
No description provided by source. pre codespan style="font: 10pt Courier New;"span class="general1-symbol"--------------------------------------------------------------------------------------- bData Dynamics ActiveBar ActiveX Control actbar3.ocx = 3.1 Multiple Inscure Methods/b url:...
hpdi-write.txt
:. GOODFELLAS Security Research TEAM .: :. http://goodfellas.shellcode.com.ar .: GoodFellas Security Research Team Technical Detail saveXMLAsFile method receives a filename as an argument, with this format "c:\path\file". Proof of C...
HP Digital Imaging 'hpqxml.dll 2.0.0.133' - Arbitrary Data Write
:. GOODFELLAS Security Research TEAM .: :. http://goodfellas.shellcode.com.ar .: GoodFellas Security Research Team Technical Detail saveXMLAsFile method receives a filename as an argument, with this format "c:\path\file". Proof of Concept -- Hpqxml.dll 2.0.0.133 HP Digital Imaging Arbitary Data...
webapp-exec.txt
There is a system access vulnerability in the Menu Manager Mod for WebAPP. This mod is available at http://www.2xlnt.com/webapp/development/app.cgi?action=downloadinfo&cat=webappmods&id=3 . System commands can be entered in user's personal menus. Any system command works there and allows reading ...
Menu Manager Mod for WebAPP - No Input Filtering
There is a system access vulnerability in the Menu Manager Mod for WebAPP. This mod is available at http://www.2xlnt.com/webapp/development/app.cgi?action=downloadinfo&cat=webappmods&id=3 . System commands can be entered in user's personal menus. Any system command works there and allows reading ...
CVE-2007-3021
Symantec Reporting Server before 1.0.224.0 (used with SCS 3.1 and SAV CE 10.1+) fails to initialize a critical variable during data export, allowing an attacker to manipulate the exported file to create arbitrary executable files. This could lead to remote code execution in the web server context...
Code injection
Progress Webspeed Messenger allows remote attackers to read, create, modify, and execute arbitrary files by invoking webutil/cpyfile.p in the WService parameter to 1 cgiip.exe or 2 wsisa.dll in scripts/, as demonstrated by using the save,editor options to create a new file using the fileName...
CVE-2007-2266
Progress Webspeed Messenger allows remote attackers to read, create, modify, and execute arbitrary files by invoking webutil/cpyfile.p in the WService parameter to 1 cgiip.exe or 2 wsisa.dll in scripts/, as demonstrated by using the save,editor options to create a new file using the fileName...
CVE-2007-2266
Progress Webspeed Messenger is affected by a vulnerability where an attacker can remotely read, create, modify, and execute arbitrary files by invoking webutil/_cpyfile.p in the WService parameter to (1) cgiip.exe or (2) wsisa.dll in scripts/, as demonstrated through the save, editor options usin...
CVE-2007-2266
Progress Webspeed Messenger allows remote attackers to read, create, modify, and execute arbitrary files by invoking webutil/cpyfile.p in the WService parameter to 1 cgiip.exe or 2 wsisa.dll in scripts/, as demonstrated by using the save,editor options to create a new file using the fileName...